bugGNUstep - Bugs: bug #29764, NSURLProtocol unescapes URL...


You are not allowed to post comments on this tracker with your current authentication level.

bug #29764: NSURLProtocol unescapes URL requests before sending

Submitted by:  Adam Fedor <fedor>
Submitted on:  Tue 04 May 2010 12:01:55 AM UTC  
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

( Jump to the original submission)

Wed 05 May 2010 05:21:41 PM UTC, comment #9: 

Well, it's pretty good for now.  I'll do some debugging later and see if I can understand it better.

Adam Fedor <fedor>
Project Administrator
Wed 05 May 2010 04:09:08 PM UTC, comment #8: 

The _urlString ivar is the relative part of the URL ... it's not necessarily just the path (and it might only be part of the path).
I'm not saying we can't mimic OSX private behaviors, just that it's not straightforward/simple to do it.

Richard Frith-Macdonald <CaS>
Project Member
Wed 05 May 2010 03:50:12 PM UTC, comment #7: 

What about _urlString? That appears to be the original string passed in (not sure if baseURL should be included as well, I don't think I understand this well).

Adam Fedor <fedor>
Project Administrator
Wed 05 May 2010 03:33:19 PM UTC, comment #6: 

The problem with the fragment should be fixed now.

Richard Frith-Macdonald <CaS>
Project Member
Wed 05 May 2010 03:22:08 PM UTC, comment #5: 

As far as I can tell, there's no API to get the original path from an NSURL ... so if OSX is doing that, I guess it must be using some private API.
Possibly we could work under debug to reverse-engineer that ... but we don't store the  original string, so t would be quite a rewrite.

Richard Frith-Macdonald <CaS>
Project Member
Wed 05 May 2010 03:13:10 PM UTC, comment #4: 

To make it even more complex. Try sending this URL:


From MacOSX:

Perhaps I could do more testing to figure out how things really work...

Adam Fedor <fedor>
Project Administrator
Wed 05 May 2010 03:06:26 PM UTC, comment #3: 

That at least works with my application, but I can't help but think it should just pass on the original value of the URL instead of unescaping the URL and then escaping it again.  To be more concrete, I've attached a simple test program which sends stuff to a local web server  (all.cgi = "#/bin/sh\nset\n"). The sent URL is:


Sent from MacOSX, I get:
From gnustep-base:

which leads me to believe that MacOSX does not do anything to the URL before sending it..

(file #20449)

Adam Fedor <fedor>
Project Administrator
Wed 05 May 2010 01:45:44 PM UTC, comment #2: 

Yep ... fixed to add percent escapes to the path in the request.
Also applied similar fix to GSHTTPURLHandle.m

Richard Frith-Macdonald <CaS>
Project Member
Wed 05 May 2010 01:21:29 PM UTC, comment #1: 

I'll check the HTTP standards ... I guess the path supplied in the request ought to be escaped, but I'm not sure.

Richard Frith-Macdonald <CaS>
Project Member
Tue 04 May 2010 12:01:55 AM UTC, original submission:  

Before sending out a request, NSURLProtocol takes a valid URL and UNescapes the string (using -[NSURL fullPath], near NSURLProtocol.m:1278), so that something like


gets sent as


-fullPath is used in several places, so I'm not sure if that method is wrong or just the use in this case.

Adam Fedor <fedor>
Project Administrator


Attached Files
file #20449:  GDataLogin.m added by fedor (2KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by fedor (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-05-05 fedor Open/ClosedIn Test => Closed
    2010-05-05 fedor Attached File- => Added GDataLogin.m, #20449
    2010-05-05 CaS StatusNone => Fixed
        Open/ClosedOpen => In Test

    Back to the top

    Powered by Savane 3.5